Topic
php
PHP runtime security releases: the code path behind each CVE, which SAPI and configuration reach it, and the upgrade that closes it.
3 engineering notes.
- CVE-2026-109618: PHP memory exhaustion and request cleanupHow PHP's OOM bailout corrupts request state, why mod_php and FPM differ, and how to verify a patched deployment.
- CVE-2026-109619: stale PHP state across worker requestsThe producer-consumer lifetime bug behind CVE-2026-109619, conditional FPM exposure, and a practical worker-replacement and configuration review.
- CVE-2026-115560: audit PHP session serialization changesThe configuration and application-code conditions behind PHP's October 23 session advisory, with a source audit, mitigation placement and regression plan.
Related service: Security & Penetration Testing →
